The dataset consists of records from the NTFS file system and event logs. In this study, we used images of devices from capture the flags competitions focused on the digital forensic of Windows operating systems and user activities. We created timelines of the security incident from the disk images using the Plaso tool, which we then processed and transformed the attributes of the timelines into binary values to simplify the application of data analysis and machine learning methods. The data are divided into 12 different files, and they are saved in CSV format.